Report Criminal Law in the Face of Cyberattacks

APRIL 2021

REPORT

CRIMINAL LAW IN THE FACE OF CYBERATTACKS

Working group chaired by Bernard spitz, president of the international and Europe division of MEdEF, former president of the French insurance Federation (FFA)

General secretary: valérie Lafarge-sarkozy,

Lawyer, Partner with the law ﬁrm Altana

CRIMINAL LAW IN THE FACE
OF CYBERATTACKS

CLUB DES JURISTES REPORT

Ad hoc commission

APRIL 2021

4, rue de la Planche 75007 Paris
Phone: 01 53 63 40 04 www.leclubdesjuristes.com

Find us on

2

PREFACE

n the shadow of the global health crisis that has held the world in its grip since 2020, episodes of cyberattacks have multiplied. We should be careful not to see this as mere coincidence, an

I

unexpected combination of calamities that unleash themselves in a relentless series bearing no relation to one another. On the contrary, the major disruptions or transitions caused in our societies by the Covid-19 pandemic have been conducive to the growth of offences which, though to varying degrees rooted in digital, are also symptoms of contemporary vulnerabilities. The vulnerability of some will have been the psychological breeding ground for digital offences committed during the health crisis. In August 2020, the Secretary-General of Interpol warned of the increase in cyberattacks that had occurred a few months before, attacks “exploiting the fear and uncertainty caused by the unstable economic and social situation brought about by Covid-19”. People anxious about the disease, undermined by loneliness, made vulnerable by their distress – victims of a particular vulnerability, those

recurrent ﬁgures in contemporary criminal law – are the chosen victims

of those who excel at taking advantage of the credulity of others. During the spring 2020 lockdown, some hundred scams registered in France were committed online by individuals posing as business leaders selling stocks of masks. The digital world then has to settle for fending off contemporary examples of classic scam behaviour. The vulnerability of information systems is itself the offspring of digital. Successive lockdowns, by promoting teleworking, telemedicine and distance selling, down to what have become the most mundane acts of everyday life such as contactless payments, have helped to multiply the circumstances that can give rise to the commission of cyberattacks. The defence to these, here as elsewhere, relies on the impossibility of access. Alas! Pirated passwords, uncorrected vulnerabilities, simple human failures (such as inadvertently downloading a trojan) literally open the doors of computer systems.

What if all this revealed a structural vulnerability, that of our societies? Bound hand and foot to digital, contemporary societies draw from it what makes them both successful and fragile, in an edifying testimony to the ambivalence of digital. In fact, the Covid-19 pandemic has only exacerbated existing trends. For a long time now the risks of

cyberattacks have been well identiﬁed, even where they are not already

taking place. It should be recalled that the intangible dimension of cyberattacks does not mean they cannot attack, whether directly or indirectly, the bodily integrity or even the life of a person. In 2019, the US Department of Homeland Security warned of vulnerabilities in the radio

communication system of certain cardiac deﬁbrillators: if malicious

3

persons took advantage of such vulnerabilities, they could cause the death of a patient. In Germany, a woman in a life-threatening emergency could not be operated on at a hospital because it was being targeted

by ransomware affecting around thirty of its servers: the woman died

while she was being transferred to another hospital, having been admitted too late. On a larger scale, the combination of cyberattacks

and terrorism represents “the” threat of the twenty-ﬁrst century. In a conﬁguration bringing the two together, “conventional” acts of terrorism

such as the killings at the Bataclan could be supported by cyberattacks,

for example targeting trafﬁc-light systems: the key element being a total disruption of trafﬁc, hampering the arrival of emergency and security

forces. A further step towards dematerialisation and, as cyber war already shows us (think of the hacking of Iran’s nuclear programme by

the Stuxnet virus attributed to the NSA, at any rate regarded as the ﬁrst

cyber weapon), we need to keep in mind the spectre of cyberattacks on OVIs, operators of vital importance. But already the link between terrorism and cyberattacks is well established on another level. The

ﬁnancial windfall which results from them, via ransoms or data sales,

helps to support terrorist funding networks. Individuals are paying a high price for these attacks, but also and above all businesses. As the prime targets of cyberattacks, businesses of all sizes need to prepare for them and know how to respond when an attack occurs. A comprehensive approach to this issue has been presented to Le Club des Juristes by Valérie Lafarge-Sarkozy, a lawyer and expert of the Club. A commission was set up under the chairmanship of Bernard Spitz, the Ad Hoc Commission on Cyber Risk, bringing together experts

from very different ﬁelds but whose areas of interest converge on

digital. First considering it in terms of risk, a collective reflection by a sub-committee tasked with considering the insurance implications of cyberattacks led to an initial report entitled “Insuring Cyber Risk”, published by Le Club des Juristes in January 2018. As a follow-up to this reflection, another sub-committee was appointed to consider the law enforcement component. Having completed its work, it is delivering this report on “Criminal law in the face of cyberattacks”. The editors of the report have brought all their experience to bear as professionals working closely with cyberattacks. Valérie Lafarge-Sarkozy and Laetitia Dage, lawyers, Myriam Quéméner, prosecutor (avocat général) at the Paris Court of Appeal and Anne Souvira, chief superintendent

(commissaire divisionnaire) and ofﬁcer responsible for cybercrime issues at the ofﬁce of the Paris Metropolitan Police Commissioner (préfet de

police de Paris), have shared their skills and experience in drawing up the report. This author has had the privilege of following its genesis and today has the pleasure of writing the preface.

4

In its first two parts, the report addresses substantive criminal law and criminal procedure. As regards the first, the reader will find an informative

presentation of the offences involved. Reviewing the conventional offences available (at least those which are of general application), the

report recalls that it is possible to call upon both those classiﬁed as

offences against property – theft and fraud – and offences against the person such as identity theft. Emphasis is also placed, of course, on

the more speciﬁc offences of attacks on automated data processing

systems (ADPS), combined with certain offences relating particularly to the processing of personal data. Hence a possible reversal in outlook is outlined, as businesses that are the victims of cyberattacks on their ADPS might themselves be liable for the inadequate protection of those systems. In the discussion of the offences, a call for caution should therefore be noted, which is explicitly expressed in developments designed to establish pre-emptive rules of e-governance for businesses. But when the damage is done, one must turn to the judicial response. The second part of the report offers this some very rich developments, highly practical in tone, which will be a very helpful guide for victims

of cyberattacks. The ﬁrst two parts of the report are not only full of

various insights and advice, but also contain interviews with specialists, which give to the whole a resolutely practical and operational twist. But the report does not end there. As a conclusion, a third part offers

“10 recommendations for advancing the ﬁght against cybercrime”. One

can only hope that these recommendations will be heard by the various institutions to which they are addressed. Might one dare to formulate an 11^th, a recommendation that in fact simply translates what runs like a watermark through this report, namely that digital should not make

us forget basic common sense: discretion is the better part of valour –

even in digital, especially in digital.

Agathe Lepage

Professor at Université Panthéon-Assas (Paris II)

5

TAblE oF ConTEnTs

PREFACE

38

inTRoduCTion PART onE

LEGAL TREATMENT OF CYBERATTACKS AND ECONOMIC

AND SOCIAL CONSEQUENCES

18

ChApTER I. :

Offences targeting automated data processing systems

(Adps)

19

SECTION I ꢀꢀDeﬁnition of adps and data processing

19

SECTION II The speciﬁc case of connected devices

20 21 25

SECTION III Different attacks on adps and

their punishment

SECTION Iv ꢀConsequences for businesses of attacks

on their adps

iv-1. "Theft" of personal data, industrial and

commercial secrets

25

26

iv-2. Financial and image consequences

iv-3. Risk of penalties in the event of failures

of security of ADPS

28

33

SECTION v ꢀ The need to establish preventive rules

of e-governance within overall business risk management systems

ChApTER II. :

Traditional offences in cyberspace

38

SECTION I ꢀ Damage to property

38

SECTION II Identity theft that damages the reputation

of a business

41

6

PART TWo

CYBERATTACK: WhAT JUDICIAL RESpONSE?

45

ChApTER I. :

The players and their institutional framework

46

46 46

SECTION I The french system

i-1. Specialisation of the investigative services

i-2. The specialisation of judges

52

i-3. The role of the national agency for the security of information systems and the independent

administrative authorities

56

SECTION II International police and judicial

cooperation

57

ii-1. The players at european and international level

ii-2. Texts currently under discussion ii-3. the 2^ndprotocol to the Budapest convention
58 59

ChApTER II :

The implementation of criminal proceedings and the means

of evidence

61

SECTION I ꢀꢀThe complaint

i-1. The ﬁling of a complaint

i-2. The handling of a complaint i-3. The investigation
63 64

64

i-4. Possible judicial follow-up to the investigation

SECTION II Evidence and its limitations

ii-1. Procedures for access to digital evidence
68 68

ii-2. Retention of data by operators

70

72

ii-3. Means of access to encrypted data

PART THREE

10 RECOMMENDATIONS FOR ADvANCING ThE FIGhT

AGAINST CYBERCRIME

73

ComPosiTion oF THE Commission

82

7

InTRoDUCTIon

◼ 1. While cyberspace is a powerhouse of growth and innovation, it is also plagued by malevolent exploitation of its flaws and

vulnerabilities. This is the ambivalence of digital: both an economic

lever – a source of value and preservation of economic activity, as

we saw recently with the ﬁrst health crisis in March 2020 – and

also a source of cybercrime, as the same health crisis revealed, with a considerable increase in attacks, remote working having become the source of 20% of cybercrime incidents.

In France, in 2018 80% of companies reported an incident of cybercrime¹. In 2019 the rate rose to 90%, 43% relating to SMEs, and in 2020 the rate rose 4-fold, requiring President Macron on Thursday, February 18, 2021 to present his cyber-defence strategy in response to the exponential growth of threats and attacks.

◼ 2. Numerous international reports measure the direct and indirect costs of digital attacks. For example, in 2017 the overall cost was $600 billion. In 2018 the average cost per business was €8.6 million²for French businesses and $27.4 million on average for US businesses.

The year 2019 conﬁrmed the rise in indirect attacks exploiting

relationships between partners. Indeed, given the current maturity level of the ultimate targets, cybercriminals bypass them by attacking a partner/supplier of digital services, internet access, outsourcing companies, etc. The scope of the attack is thereby multiplied, and in 5-year forecasts, 23% of the cost of attacks could result from such attacks targeting third-party information systems in order to reach the real target.³

As for 2020, based on the ﬁrst half of the year it will be a record

year in France with, for example, a 667% increase in phishing attacks recorded between 1 and 23 March.⁴According to a report by VMware Carbon Black⁵, between February and March 2020 ransomware attacks increased by 148% worldwide, with one attack taking place every 14 seconds.

◼ 3. Globally, cybercrime is expected to cost businesses $6,000 billion annually from 2021.⁶

1. Report of the Ministry of the Interior "The state of the digital threat"

2. https://www.accenture.com/fr-fr/insights/security/etude-cout-du-cybercrime 3. https://www.accenture.com/fr-fr/insights/security/etude-cout-du-cybercrime 4. https://blog.barracuda.com/2020/03/26/threat-spotlight-coronavirus-related-phishing/ 5. https://www.carbonblack.com/blog/amid-covid-19-global-orgs-see-a-148-spike-in-ransomware-attacks- ﬁnance-industry-heavily-targeted/
6. Annual Report of Cybersecurity Ventures and Herjavec Group, 2019, https://www.herjavecgroup.com/ wp-content/uploads/2018/12/CV-HG-2019-Ofﬁcial-Annual-Cybercrime-Report.pdf

8

◼ 4. The risk/cost/gain ratio of cybercrime is very advantageous to offenders who can easily obtain online and on the darknet kits for around $5 that enable them to commit denial-of-service attacks, and use digital technology to industrialise and globalise their crimes.

Changes in working methods and the massive increase in teleworking have given them new and many opportunities. In the second half of 2020, the Zoom application therefore had to slow the development of its functionality in order to focus on its security,

in order to cope with the signiﬁcant increase in the number of its

daily users from 10 million in December 2019 to over 200 million in March 2020.

FOCUS

INTERvIEW WITh GUILLAUME pOUpARD Director General of National Agency for the Security of Information Systems (ANSSI)

by Brigitte Bouquot, AMRAE and Valérie Lafarge-Sarkozy, Altana

-------

1/ The pandemic has increased digital use; has it developed the cyber threat?

The increase in the cyber threat is indeed very worrying, as the number of ransomware attacks handled by ANSSI increased 4-fold between 2019 and 2020, from 54 to 192. Since the beginning of 2021, this trend has not declined and we are constantly providing assistance to some 40 victims simultaneously. Victims of importance in terms of national, economic or health security…

It is true that the health situation is a slight aggravating factor in the cyber threat, in that it complicates the lives of defenders, but not necessarily those of attackers. But it is clear that the rapid growth of the cyber threat preceded the health crisis and that the underlying trend is extremely negative. When the health crisis stops, the cyber crisis will continue. It is essential to dissociate the two subjects and deal with the cyber subject that will concern us for the long term.

2/ Could you comment on President Macron’s announcements regarding the national cyber security strategy?

The strategy announced by the President has two components. A situational component linked to the cyberattacks that struck two healthcare institutions in quick succession in February, and

an economic component based on France’s desire signiﬁcantly to

9

develop its industrial cyber-security ecosystem. This reflects both a strong concern for our society, under threat from cyberattacks, and also the need to enhance our industrial base to address the growing threat and assert our position as a major player in cyber security on the world stage. Indeed, we have many successful players in France which are investing heavily in cyber technology and are capable of providing trusted solutions to French, European and international stakeholders. At the international level, French solutions are

particularly sought after, for they are often hallmarks of conﬁdence.

This represents real economic opportunities for French business.

The €1 billion is broken down into several major funding streams:

research funding, the future investment plan (plan d’investissement

d’avenir - PIA4), and France Recovery (France Relance), which

includes a €136 million package to strengthen the cybersecurity of public stakeholders in a sustainable way (hospitals, local authorities, central government).

The Cyber Campus announced, very symbolically by President

Emmanuel Macron, will also beneﬁt from this funding. A true French

ambition held at the highest political level, this Campus will bring together large groups, SMEs, start-ups, researchers and authorities around cybersecurity projects. It may look heterogeneous, but in reality it is a true French team. The launch of such a Campus is a major step in our cyber strategy which includes a strong European dimension, which will culminate in the French Presidency of the Council of the European Union early in 2022.

3/ How can the development of a speciﬁc criminal component

reinforce the digital security policy conducted by ANSSI?

As a national authority, we cooperate with the investigation and intelligence agencies on a daily basis. We have developed a close collaboration with the intelligence agencies and investigation agencies (C3N, OCLCTIC, BL2C and DGSI) and the specialist cyber prosecution service (J3). There is a real convergence of views today on cyber issues within the State. ANSSI works very effectively with all these services to share its knowledge and methods. In future, it would help for information sharing between the intelligence and investigation agencies to be deepened further, as the sharing of

technical information is essential to the ﬁght against the cyber

threat. International judicial cooperation is increasingly working to combat cybercrime. Recently we have had some real successes with, for example, the dismantling of the Emotet and Egregor networks.

These examples change the sense of fear that is around and deliver a positive message. International judicial cooperation is developing very clearly in Europe, but also with our Western allies and even

10

beyond. We all have an interest in reducing the number of places where cybercriminals can act and lurk.

4/ What are your digital security tips for business leaders?

Digital risk must be integrated into the overall risk management of each business. Business leaders need to use regulatory leverage and invest 5-10% of their IT budget in cyber security in order to build

efﬁcient solutions. Our ecosystem of trusted providers, many of

whom have an ANSSI Security Visa, is able to support and advise businesses effectively. Better protection for our businesses will help to limit serious attacks, raise the level of cyber security and manage residual risk effectively, including the development of insurance mechanisms. It is essential for every business to use the levers that it has to secure itself and to be accountable for this so that everyone can continue to take full advantage of the opportunities of digital.

◼ 5. In this context it seemed necessary, for a proper understanding of this report and of the challenges of cyber security for businesses,

to begin by deﬁning the concepts of cyberspace (i), cybercrime (ii), cyber security (iii) and cyber defence (iv):

(i) Cyberspace is a world of communication and sharing made up of infrastructures, networks and information systems (IS), as well as electronic communications, which are interconnected throughout the world, even in space. So it is an intangible space with no borders, which fuels debate about cooperation between States (e.g. in the search for digital evidence), which wield their sovereignty by complicating possible solutions at national and international levels. ANSSI ensures that European strategic autonomy in digital security is respected^ꢀ7.